Operation behavior monitoring method and apparatus, electronic device, and storage medium

ABSTRACT

An operation behavior monitoring method includes: obtaining target historical operation behavior data of a target user, and performing data statistics on the target historical operation behavior data according to different dimensions, to build a multi-dimensional coordinate system; when a target operation behavior is received, determining a target data item corresponding to the target operation behavior in each dimension, determining whether a labeling point corresponding to the target data item exists in the multi-dimensional coordinate system or not; if yes, increasing the density of the labeling points by one; if not, determining a labeling point corresponding to the target data item in the multi-dimensional coordinate system, and setting the density of the labeling point to be  1 ; and calculating a center-of-gravity position corresponding to each coordinate axis according to the density of all the labeling points on each coordinate axis, determining a target point based on all the center-of-gravity positions.

The present disclosure claims the priority of Chinese patent applicationfiled on Jun. 29, 2020 before the CNIPA, China National IntellectualProperty Administration with the application number of 202010605998.3and the title of “OPERATION BEHAVIOR MONITORING METHOD AND APPARATUS,ELECTRONIC DEVICE, AND STORAGE MEDIUM”, which is incorporated herein inits entirety by reference.

TECHNICAL FIELD

The present disclosure relates to the technical field of servers andmore particularly, to an operation behavior monitoring method andapparatus, an electronic device, and a computer-readable storage medium.

BACKGROUND

In the information age, tens of millions of users log in a variety ofservices through account numbers and passwords every moment. However,due to the inherent openness and resource sharing of the network, thephenomenon of account numbers and passwords being illegally usedsometimes occurs. Especially when an account number and password of anetwork server or host is leaked, the server statically protected by thepassword may not identify the legitimacy of a user, which may causegreat risks and losses to a server owner and relevant enterprises andinstitutions.

In a network payment scenario, a user behavior is sequentially mined byusing a PrefixSpan association algorithm and stored in a featuredatabase, and then the user behavior is sequentially matched todetermine the confidence level of a user payment environment. In anetwork traffic scenario, user information to be detected characterizedby a user traffic behavior is detected by matching therewith. A userbehavior on a server (mainly a Linux operating system) is quitedifferent from the foregoing scenario, and a user typically operatesrelevant resources by executing various commands.

Therefore, how to perform safety monitoring on a user operation behaviorin a server is a technical problem to be solved by a person skilled inthe art.

SUMMARY

The present disclosure aims to provide an operation behavior monitoringmethod and apparatus, an electronic device, and a computer-readablestorage medium, which achieve safety monitoring of a user operationbehavior in a server.

In order to achieve the above aims, the present disclosure provides anoperation behavior monitoring method, including:

acquiring target historical operation behavior data of a target user,and performing data statistics on the target historical operationbehavior data according to different dimensions so as to establish amulti-dimensional coordinate system, and coordinate axes in themulti-dimensional coordinate system are in one-to-one correspondencewith the dimensions;

determining, in response to receiving a target operation behavior, atarget data item corresponding to the target operation behavior in eachof the dimensions, and determining whether a marking point correspondingto the target data item exists in the multi-dimensional coordinatesystem;

increasing a density of the marking point by one under the conditionthat the marking point corresponding to the target data item exists inthe multi-dimensional coordinate system;

under the condition that the marking point corresponding to the targetdata item does not exist in the multi-dimensional coordinate system,determining the marking point corresponding to the target data item inthe multi-dimensional coordinate system, and setting the density of themarking point to be one, and a coordinate value of the marking pointcorresponding to the target data item is less than 1 under the conditionthat the target data item exists in the target historical operationbehavior data, and the coordinate value of the marking pointcorresponding to the target data item is greater than 1 under thecondition that the target data item does not exist in the targethistorical operation behavior data; and

calculating a center of gravity corresponding to each of the coordinateaxes according to the density of all the marking points on each of thecoordinate axes, and determining a target point based on all the centersof gravity so as to perform safety monitoring on the target operationbehavior according to the position of the target point.

In an embodiment of the present disclosure, the performing datastatistics on the target historical operation behavior data according todifferent dimensions so as to establish a multi-dimensional coordinatesystem includes:

performing the data statistics on the target historical operationbehavior data according to different dimensions to obtain all data itemscontained in each of the dimensions and a frequency of each of the dataitems, and normalizing the frequency to obtain a standard frequency ofeach of the data items; and

establishing a multi-dimensional coordinate system, and marking each ofthe data items on a coordinate axis corresponding to the dimension towhich each of the data items belongs based on the standard frequency ofeach of the data items, and the coordinate axes in the multi-dimensionalcoordinate system are in one-to-one correspondence with the dimensions,A=1−f_(A), A is the coordinate value of a marking position of the dataitem, and f_(A) is the standard frequency of the data item.

In an embodiment of the present disclosure, after the marking each ofthe data items on a coordinate axis corresponding to the dimension towhich each of the data items belongs based on the standard frequency ofeach of the data items, the method further includes:

determining a total number of data items corresponding to each of thecoordinate axes, and calculating a unit distance p of each of thecoordinate axes, and p=1/S, and S is the total number of the data items;

the determining a marking point corresponding to the target data item inthe multi-dimensional coordinate system includes:

determining B=1−f_(B) under the condition that the target data itemexists in the target historical operation behavior data, and B is thecoordinate value of the marking point of the target data item, and f_(B)is the standard frequency of the target data item in the targethistorical operation behavior data; and

determining B=1+bp under the condition that the target data item doesnot exist in the target historical operation behavior data, and b is apositive integer and b is negatively correlated with the frequency ofthe target data item in the target operation behavior.

In an embodiment of the present disclosure, before the normalizing thefrequency to obtain a standard frequency of each of the data items, themethod further includes:

acquiring historical operation behavior data of all users, anddetermining duplicate data items in the historical operation behaviordata of different users;

denoising the duplicate data items in the target historical operationbehavior data according to principle that a higher frequency of theduplicate data items corresponds to a lower weight, so as to update thefrequency of the data items;

the normalizing the frequency to obtain a standard frequency of each ofthe data items includes:

normalizing an updated frequency to obtain the standard frequency ofeach of the data items.

In an embodiment of the present disclosure, a frequency updating formulaof the data item is:

${f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}},$

where f₀ is the updated frequency of the data item, f is an originalfrequency of the data item, F is a sum of the frequencies of the dataitems in historical operation behavior data corresponding to all users,N is the total number of the users, n is the total number of users whohave the data item, and k is an experience coefficient.

In an embodiment of the present disclosure, the performing safetymonitoring on the target operation behavior according to the position ofthe target point includes:

determining whether the target point is within a preset safe area, anddetermining that the target operation behavior is a safe operationbehavior under the condition that the target point is within a presetsafe area;

or, calculating a safe confidence level of the target operation behaviorbased on a distance between the target point and an original point inthe multi-dimensional coordinate system, and the safe confidence levelis negatively correlated with the distance between the target point andthe original point in the multi-dimensional coordinate system.

In an embodiment of the present disclosure, the dimension includes awork directory, an operation instruction and a login identification.

In order to achieve the above aims, the present disclosure provides anoperation behavior monitoring apparatus, including:

an establishment module, configured to acquire target historicaloperation behavior data of a target user, and perform data statistics onthe target historical operation behavior data according to differentdimensions so as to establish a multi-dimensional coordinate system, andcoordinate axes in the multi-dimensional coordinate system are inone-to-one correspondence with the dimensions;

a determining module, configured to determine, in response to receivinga target operation behavior, a target data item corresponding to thetarget operation behavior in each of the dimensions, and determinewhether a marking point corresponding to the target data item exists inthe multi-dimensional coordinate system, and a work flow of a densityupdating module is started under the condition that the marking pointcorresponding to the target data item exists in the multi-dimensionalcoordinate system and a work flow of a determination module is startedunder the condition that the marking point corresponding to the targetdata item does not exist in the multi-dimensional coordinate system;

the density updating module, configured to increase the density of themarking point by one;

the determination module, configured to determine the marking pointcorresponding to the target data item in the multi-dimensionalcoordinate system, and set the density of the marking point to be one,and a coordinate value of the marking point corresponding to the targetdata item is less than 1 under the condition that the target data itemexists in the target historical operation behavior data, and thecoordinate value of the marking point corresponding to the target dataitem is greater than 1 under the condition that the target data itemdoes not exist in the target historical operation behavior data; and

a monitoring module, configured to calculate a center of gravitycorresponding to each of the coordinate axes according to the density ofall the marking points on each of the coordinate axes, and determine atarget point based on all the centers of gravity so as to perform safetymonitoring on the target operation behavior according to the position ofthe target point.

In order to achieve the above aims, the present disclosure provideselectronic device, including:

a memory, configured to store a computer program; and

a processor, configured to implement, when executing the computerprogram, the operations of the operation behavior monitoring methodaccording to the above description.

In order to achieve the above aims, the present disclosure provides acomputer-readable storage medium, storing a computer program which, whenexecuted by a processor, implements the operations of the operationbehavior monitoring method according to the above description.

From the above solution, it is apparent that the operation behaviormonitoring method provided by the present disclosure includes: acquiringtarget historical operation behavior data of a target user, andperforming data statistics on the target historical operation behaviordata according to different dimensions so as to establish amulti-dimensional coordinate system, and coordinate axes in themulti-dimensional coordinate system are in one-to-one correspondencewith the dimensions; determining, in response to receiving a targetoperation behavior, a target data item corresponding to the targetoperation behavior in each of the dimensions, and determining whether amarking point corresponding to the target data item exists in themulti-dimensional coordinate system; increasing the density of themarking point by one under the condition that the marking pointcorresponding to the target data item exists in the multi-dimensionalcoordinate system; under the condition that the marking pointcorresponding to the target data item does not exist in themulti-dimensional coordinate system, determining the marking pointcorresponding to the target data item in the multi-dimensionalcoordinate system, and setting the density of the marking point to beone, and a coordinate value of the marking point corresponding to thetarget data item is less than 1 under the condition that the target dataitem exists in the target historical operation behavior data, and thecoordinate value of the marking point corresponding to the target dataitem is greater than 1 under the condition that the target data itemdoes not exist in the target historical operation behavior data; andcalculating a center of gravity corresponding to each of the coordinateaxes according to the density of all the marking points on each of thecoordinate axes, and determining a target point based on all the centersof gravity so as to perform safety monitoring on the target operationbehavior according to the position of the target point.

According to the operation behavior monitoring method provided by thepresent disclosure, the historical operation behavior data isstatistically processed according to different dimensions to establishthe multi-dimensional coordinate system. Under the condition that thetarget operation behavior is received, the target operation behavior isconverted into points in the established multi-dimensional coordinatesystem. The points closer to an original point represent a higherconfidence level, and the points beyond a certain distance from theoriginal point represent a higher risk. Thus, a user operation behavioris quantitatively analyzed and monitored. Apparently, according to theoperation behavior monitoring method provided by the present disclosure,a safety confidence level of a user behavior is quantitatively analyzedthrough a multi-dimensional coordinate positioning scheme, an abnormaluser behavior may be quickly monitored and identified, and risks may beprompted in time so as to reduce subsequent losses. The presentdisclosure also discloses an operation behavior monitoring apparatus, anelectronic device and a computer-readable storage medium, which may alsoachieve the above technical effects.

It should be understood that the above general description and thefollowing detailed description are only exemplary and not intended tolimit the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly describe the embodiments of the presentdisclosure or the technical solution in the prior art, the followingwill briefly introduce the drawings needed to be used in the embodimentsor the prior technical description. Obviously, the drawings in thefollowing description are only some embodiments of the presentdisclosure. For ordinary technicians in the art, they may also obtainother drawings based on these drawings without paying creative labor.The accompanying drawings are intended to provide a furtherunderstanding of the present disclosure and form a part of thespecification. They are used to explain the present disclosure togetherwith the following specific embodiments, but do not constitute alimitation on the present disclosure. In the attached drawings:

FIG. 1 shows a flow chart of an operation behavior monitoring methodaccording to an exemplary embodiment;

FIG. 2 shows a flow chart of another operation behavior monitoringmethod according to an exemplary embodiment;

FIG. 3 shows a schematic overall flow chart of an application embodimentaccording to the present disclosure;

FIG. 4 is a schematic diagram of detailed operations of a dimension dataprocessing device;

FIG. 5 is a schematic diagram of detailed operations of a monitoringdevice;

FIG. 6 shows a structural diagram of an operation behavior monitoringapparatus according to an exemplary embodiment;

FIG. 7 shows a structural diagram of an electronic device according toan exemplary embodiment; and

FIG. 8 shows a structural diagram of a computer-readable storage mediumaccording to an exemplary embodiment.

DETAILED DESCRIPTION OF THE EMBODIMENTS

The technical solutions in the embodiments of the present disclosurewill be described clearly and completely below in combination with thedrawings in the embodiments of the present disclosure. Obviously, thedescribed embodiments are only part of the embodiments of the presentdisclosure, not all of them. Based on the embodiments in the presentdisclosure, all other embodiments obtained by ordinary technicians inthe art without doing creative work belong to the scope of protection inthe present disclosure.

An embodiment of the present disclosure discloses an operation behaviormonitoring method, which achieves safety monitoring of a user operationbehavior in a server.

FIG. 1 shows a flow chart of an operation behavior monitoring methodaccording to an exemplary embodiment. As shown in FIG. 1 , the methodincludes the following operations:

S101: acquiring target historical operation behavior data of a targetuser, and performing data statistics on the target historical operationbehavior data according to different dimensions so as to establish amulti-dimensional coordinate system, wherein coordinate axes in themulti-dimensional coordinate system are in one-to-one correspondencewith the dimensions.

In the present embodiment, operation behavior data of a target userlogging in a server within a period of time, i.e., target historicaloperation behavior data, is acquired, data statistics is performedthereon according to different dimensions, all data items contained inthe target historical operation behavior data are obtained, and dataitems corresponding to the respective dimensions are determined. Amulti-dimensional coordinate system is established based on a frequencyof each data item, and coordinate axes in the multi-dimensionalcoordinate system are in one-to-one correspondence with the dimensions.

The dimension herein may include a work directory, an operationinstruction and a login identification. A work directory refers to afile directory where a user executes some operation commands on a Linuxsystem, and represents a file tree location where the user executes thecommands, such as “/root/foo”, “/etc/bar”, or “/home/userA”, and so on.The operation instruction refers to an operation instruction input bythe user after logging in the Linux operating system, such as“cd/root/foo”, “who am i”, or “hdfs dfs -ls/bar”, and so on.

S102: determining, in response to receiving a target operation behavior,a target data item corresponding to the target operation behavior ineach of the dimensions, and determining whether a marking pointcorresponding to the target data item exists in the multi-dimensionalcoordinate system; if yes, proceeding to S103; if no, proceeding toS104.

S103: increasing the density of the marking point by one.

S104: determining a marking point corresponding to the target data itemin the multi-dimensional coordinate system, and setting the density ofthe marking point to be one, wherein a coordinate value of the markingpoint corresponding to the target data item is less than 1 under thecondition that the target data item exists in the target historicaloperation behavior data, and the coordinate value of the marking pointcorresponding to the target data item is greater than 1 under thecondition that the target data item does not exist in the targethistorical operation behavior data.

In a specific implementation, under the condition that a targetoperation behavior is received, the target operation behavior isconverted into points in the multi-dimensional coordinate system.Firstly, a target data item corresponding to a target operation behaviorin each dimension is determined. Then, each target data item is markedin a multi-dimensional coordinate system. That is, a marking pointcorresponding to the target data item is determined on a coordinate axiscorresponding to the dimension to which each target data item belongs,and the density of each target data item is determined.

Specifically, if the target data item exists in the target historicalbehavior data, a coordinate value of the marking point corresponding tothe target data item is less than 1. In an aspect of the presentdisclosure, the coordinate value of the marking point corresponding tothe target data item is negatively correlated with the frequency thereofin the target historical behavior data. That is, as the frequency of thetarget data item in the target historical behavior data is higher, thecoordinate value of the marking point corresponding thereto is less andthe distance to an original point is shorter. If the target data itemdoes not exist in the target historical behavior data, a coordinatevalue of the marking point corresponding to the target data item isgreater than 1. In an aspect of the present disclosure, the coordinatevalue of the marking point corresponding to the target data item isnegatively correlated with the frequency thereof in all target operationbehaviors. That is, as the frequency of the target data item in all thetarget operation behaviors is higher, the coordinate value of themarking point corresponding thereto is less and closer to 1.

For example, the work directory corresponds to an x-axis of themulti-dimensional coordinate system, the operation instructioncorresponds to a y-axis, the login identification corresponds to az-axis, and the data items corresponding to the target operationbehavior in each dimension are: work directory A, operation instructionB and login identification C. If work directory A and operationinstruction B exist in the target historical operation behavior data,the marking point of work directory A is located at [0, 1] on thex-axis, the marking point of operation instruction B is located at [0,1] on the y-axis, and the marking point of login identification C islocated at a position greater than 1 on the z-axis.

S105: calculating a center of gravity corresponding to each of thecoordinate axes according to the density of all the marking points oneach of the coordinate axes, and determining a target point based on allthe centers of gravity so as to perform safety monitoring on the targetoperation behavior according to the position of the target point.

In this operation, the center of gravity corresponding to eachcoordinate axis is calculated by using the following calculationformula:

${P_{c} = \frac{\sum\limits_{i = 0}^{n}{P_{i} \bullet C_{i}}}{\overset{n}{\sum\limits_{i = 0}}P_{i}}},$

where P_(c) is the center of gravity, P_(i) is the density of themarking point, and C_(i) is the coordinate value of the marking point.

A target point may be uniquely determined based on the center of gravityof each coordinate axis, and safety monitoring may be performed on thetarget operation behavior based on the position of the target point. Asa feasible implementation, the operation of performing safety monitoringon the target operation behavior according to the position of the targetpoint may include: determining whether the target point is within apreset safe area, and determining that the target operation behavior isa safe operation behavior under the condition that the target point iswithin a preset safe area. As another feasible implementation, theoperation of performing safety monitoring on the target operationbehavior according to the position of the target point may include:calculating a safe confidence level of the target operation behaviorbased on a distance between the target point and an original point inthe multi-dimensional coordinate system, wherein the safe confidencelevel is negatively correlated with the distance between the targetpoint and the original point in the multi-dimensional coordinate system.

According to the operation behavior monitoring method provided by theembodiment of the present disclosure, the historical operation behaviordata is subjected to statistics according to different dimensions toestablish a multi-dimensional coordinate system. Under the conditionthat a target operation behavior is received, the target operationbehavior is converted into points in the established multi-dimensionalcoordinate system. The points closer to an original point represent ahigher confidence level, and the points beyond a certain distance fromthe original point represent a higher risk. Thus, a user operationbehavior is quantitatively analyzed and monitored. Apparently, accordingto the operation behavior monitoring method provided by the embodimentof the present disclosure, a safety confidence level of a user behavioris quantitatively analyzed through a multi-dimensional coordinatepositioning scheme, an abnormal user behavior may be quickly monitoredand identified, and risks may be prompted in time so as to reducesubsequent losses.

An embodiment of the present disclosure discloses an operation behaviormonitoring method. The present embodiment further describes andoptimizes the technical solution as compared to the previous embodiment.Specifically:

FIG. 2 shows a flow chart of another operation behavior monitoringmethod according to an exemplary embodiment. As shown in FIG. 2 , themethod includes the following operations:

S201: acquiring target historical operation behavior data of a targetuser.

S202: performing data statistics on the target historical operationbehavior data according to different dimensions to obtain all data itemscontained in each of the dimensions and a frequency of each of the dataitems, and normalizing the frequency to obtain a standard frequency ofeach of the data items.

S203: establishing a multi-dimensional coordinate system, and markingeach of the data items on a coordinate axis corresponding to thedimension to which each of the data items belongs based on the standardfrequency of each of the data items.

The coordinate axes in the multi-dimensional coordinate system are inone-to-one correspondence with the dimensions, A=1−f_(A), A is thecoordinate value of a marking position of the data item, and f_(A) isthe standard frequency of the data item.

In the present embodiment, the data items in the target historicaloperation behavior data need to be marked in [0, 1] on the coordinateaxis corresponding to the dimension to which the data items belong.Therefore, the frequency of each data item needs to be normalized toobtain a standard frequency.

In an aspect of the present disclosure, before the normalizing thefrequency to obtain a standard frequency of each of the data items, themethod further includes: acquiring historical operation behavior data ofall users, and determining duplicate data items in the historicaloperation behavior data of different users; and denoising duplicate dataitems in the target historical operation behavior data according toprinciple that a higher frequency of the duplicate data itemscorresponds to a lower weight, so as to update the frequency of the dataitems. Accordingly, the normalizing the frequency to obtain a standardfrequency of each of the data items includes: normalizing the updatedfrequency to obtain the standard frequency of each of the data items.

In a specific implementation, the historical operation behavior data ofall users is acquired, the frequency of each data item is statisticallyprocessed across users, and duplicate data items contained in differentusers are denoised based on the principle that a higher frequency of theduplicate data items corresponds to a lower weight, so as to update thefrequency of the duplicate data items in the target historical operationbehavior. A frequency updating formula of the data item is:

${f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}},$

where f₀ is the updated frequency of the data item, f is the originalfrequency of the data item, F is the sum of the frequencies of the dataitems in historical operation behavior data corresponding to all users,N is the total number of users, n is the total number of users who havethe data item, and k is an experience coefficient, and may be adjustedaccording to the importance of the data item in the technical field towhich the target user belongs.

The formula of normalization is:

${f_{A} = \frac{f_{0} - {Min}}{{Max} - {Min}}},$

where Max is a frequency maximum, and Min is a frequency minimum.

A coordinate value A of a marking position of the data item isnegatively correlated with the standard frequency thereof. Specifically,A=1−f_(A), A is the coordinate value of the marking position of the dataitem, and f_(A) is the standard frequency of the data item.

S204: determining, in response to receiving a target operation behavior,a target data item corresponding to the target operation behavior ineach of the dimensions, and determining whether a marking pointcorresponding to the target data item exists in the multi-dimensionalcoordinate system; if yes, proceeding to S205; if no, proceeding toS206.

S205: increasing the density of the marking point by one.

S206: determining a marking point corresponding to the target data itemin the multi-dimensional coordinate system, and setting the density ofthe marking point to be one, wherein a coordinate value of the markingpoint corresponding to the target data item is less than 1 under thecondition that the target data item exists in the target historicaloperation behavior data, and the coordinate value of the marking pointcorresponding to the target data item is greater than 1 under thecondition that the target data item does not exist in the targethistorical operation behavior data.

In the present embodiment, the distance between marking positions oftarget data items that do not exist in the target historical operationbehavior data may be correlated with a unit distance between thecorresponding coordinate axes. Specifically, after the marking each ofthe data items on a coordinate axis corresponding to the dimension towhich each of the data items belongs based on the standard frequency ofeach of the data items, the method further includes: determining a totalnumber of data items corresponding to each of the coordinate axes, andcalculating a unit distance p of each of the coordinate axes, whereinp=1/S, and S is the total number of the data items.

Accordingly, the determining a marking point corresponding to the targetdata item in the multi-dimensional coordinate system includes:determining B=1−f_(B) under the condition that the target data itemexists in the target historical operation behavior data, wherein B isthe coordinate value of the marking point of the target data item, andf_(B) is the standard frequency of the target data item in the targethistorical operation behavior data; and determining B=1+bp under thecondition that the target data item does not exist in the targethistorical operation behavior data, wherein b is a positive integer andb is negatively correlated with the frequency of the target data item inthe target operation behavior.

In a specific implementation, the coordinate value of the marking pointof a target data item that does not exist in the target historicaloperation behavior data is negatively correlated with the frequencythereof in the target operation behavior. As the frequency of the targetdata item in all the target operation behaviors is higher, thecoordinate value of the marking point corresponding thereto is less andcloser to 1, and the distance between the marking points correspondingto the respective target data items is an integer multiple of the unitdistance between the corresponding coordinate axes.

S207: calculating a center of gravity corresponding to each of thecoordinate axes according to the density of all the marking points oneach of the coordinate axes, and determining a target point based on allthe centers of gravity so as to perform safety monitoring on the targetoperation behavior according to the position of the target point.

An application embodiment provided by the present disclosure isdescribed below, and implemented by a dimension data processing device,a multi-dimensional positioning device and a monitoring device. Aschematic overall flow chart is shown in FIG. 3 .

The dimension data processing device is configured to divide historicaloperation behaviors of server users within a period of time intodifferent data packets according to the users, divide each data packetinto three dimensions according to “work directory”, “operationinstruction” and “login identification”, and statistically process,denoise and normalize data in each dimension. A schematic diagram ofdetailed operations of the device is shown in FIG. 4 . The detailedoperations may be as follows:

Step 1: classifying user data according to dimensions, and statisticallyprocessing a frequency of occurrence of each data item.

Step 2: statistically processing the frequency of each data item acrossuser classifications, and denoising duplicate data items under differentuser classifications according to the principle that a lower weightcorresponds to a higher frequency of the duplicate data items, asfollows:

$f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}$

where f₀ is the updated frequency of the data item, f is the originalfrequency of the data item, F is the sum of the frequencies of the dataitems in historical operation behavior data corresponding to all users,N is the total number of users, n is the total number of users who havethe data item, and k is an experience coefficient within a value rangeof 0.5-2.0 generally.

Step 3: mapping, in each dimension, the frequency values of the dataitems in sub-step 2 into [0, 1] by using a “minimal-maximalnormalization” method according to the dimensions, the processing methodbeing as follows:

${f_{0}^{\prime} = \frac{f_{0} - {Min}}{{Max} - {Min}}},$

where Max is a frequency maximum, and Min is a frequency minimum.

The multi-dimensional positioning device is configured to reversely markthe data items on each coordinate axis by using three dimension data:work directory, operation instruction and login identification as x, yand z axes of a three-axis coordinate system and (1−f₀′) as a coordinatevalue, and maintain a binding relationship between the data items andscale values of the coordinate axes corresponding thereto.

The monitoring device is configured to dot incoming data on eachdimension axis according to equal or similar data items. A schematicdiagram of detailed operations of the device is shown in FIG. 5 :

A. directly marking a position point C_(i) if the data item exists.

B. marking the item at the position point C_(i) after 1 if the data itemdoes not exist, different items being in a descending order offrequency.

C. increasing the value of the point by 1 if the position point ismarked, and recording this value as density P_(i) of the point.

D. obtaining centers of gravity P_(c) of a plurality of points on thesame dimension axis according to the following formula:

${P_{c} = \frac{\sum\limits_{i = 0}^{n}{P_{i} \bullet C_{i}}}{\overset{n}{\sum\limits_{i = 0}}P_{i}}},$

where P_(i) is the density of the marking point.

According to the three P_(c) values marked, the distance between theuniquely determined point thereof and an original point is calculated.As the distance is greater, the safety confidence level is lower. Adistance threshold value may be set, or a spatial range represents asafe area. If the threshold value or the safe area is exceeded, a nextoperation prompting risks is considered to be reached.

An operation behavior monitoring apparatus provided by an embodiment ofthe present disclosure will be introduced below. The operation behaviormonitoring apparatus described below and the operation behaviormonitoring method described above may be referred to each other.

FIG. 6 shows a structural diagram of an operation behavior monitoringapparatus according to an exemplary embodiment. As shown in FIG. 6 , theapparatus includes:

an establishment module 601, configured to acquire target historicaloperation behavior data of a target user, and perform data statistics onthe target historical operation behavior data according to differentdimensions so as to establish a multi-dimensional coordinate system,wherein coordinate axes in the multi-dimensional coordinate system arein one-to-one correspondence with the dimensions;

a determining module 602, configured to determine, in response toreceiving a target operation behavior, a target data item correspondingto the target operation behavior in each of the dimensions, anddetermine whether a marking point corresponding to the target data itemexists in the multi-dimensional coordinate system, wherein a work flowof a density updating module 603 is started under the condition that themarking point corresponding to the target data item exists in themulti-dimensional coordinate system and a work flow of a determinationmodule 604 is started under the condition that the marking pointcorresponding to the target data item does not exist in themulti-dimensional coordinate system;

the density updating module 603, configured to increase the density ofthe marking point by one;

the determination module 604, configured to determine the marking pointcorresponding to the target data item in the multi-dimensionalcoordinate system, and set the density of the marking point to be one,wherein a coordinate value of the marking point corresponding to thetarget data item is less than 1 under the condition that the target dataitem exists in the target historical operation behavior data, and thecoordinate value of the marking point corresponding to the target dataitem is greater than 1 under the condition that the target data itemdoes not exist in the target historical operation behavior data; and

a monitoring module 605, configured to calculate a center of gravitycorresponding to each of the coordinate axes according to the density ofall the marking points on each of the coordinate axes, and determine atarget point based on all the centers of gravity so as to perform safetymonitoring on the target operation behavior according to the position ofthe target point.

According to the operation behavior monitoring apparatus provided by theembodiment of the present disclosure, historical operation behavior datais subjected to statistics according to different dimensions toestablish a multi-dimensional coordinate system. Under the conditionthat a target operation behavior is received, the target operationbehavior is converted into points in the established multi-dimensionalcoordinate system. The points closer to an original point represent ahigher confidence level, and the points beyond a certain distance fromthe original point represent a higher risk. Thus, a user operationbehavior is quantitatively analyzed and monitored. Apparently, accordingto the operation behavior monitoring apparatus provided by theembodiment of the present disclosure, a safety confidence level of auser behavior is quantitatively analyzed through a multi-dimensionalcoordinate positioning scheme, an abnormal user behavior may be quicklymonitored and identified, and risks may be prompted in time so as toreduce subsequent losses.

On the basis of the above embodiment, as an implementation, theestablishment module 601 includes:

an acquisition unit, configured to acquire target historical operationbehavior data of a target user;

a statistical unit, configured to perform data statistics on the targethistorical operation behavior data according to different dimensions toobtain all data items contained in each of the dimensions and afrequency of each of the data items, and normalize the frequency toobtain a standard frequency of each of the data items; and

an establishment unit, configured to establish a multi-dimensionalcoordinate system, and mark each of the data items on a coordinate axiscorresponding to the dimension to which each of the data items belongsbased on the standard frequency of each of the data items, wherein thecoordinate axes in the multi-dimensional coordinate system are inone-to-one correspondence with the dimensions, A=1−f_(A), A is thecoordinate value of a marking position of the data item, and f_(A) isthe standard frequency of the data item.

On the basis of the above embodiment, as an implementation, theestablishment module 601 also includes:

a first calculation unit, configured to determine a total number of dataitems corresponding to each of the coordinate axes, and calculate a unitdistance p of each of the coordinate axes, wherein p=1/S, and S is thetotal number of the data items.

Accordingly, the determining module 604 includes:

a first determination unit, configured to determine B=1−f_(B) under thecondition that the target data item exists in the target historicaloperation behavior data, B being the coordinate value of the markingpoint of the target data item, and f_(B) being the standard frequency ofthe target data item in the target historical operation behavior data;

a second determination unit, configured to determine B=1+bp under thecondition that the target data item does not exist in the targethistorical operation behavior data, b being a positive integer and bbeing negatively correlated with the frequency of the target data itemin the target operation behavior; and

a density setting unit, configured to set the density of the markingpoint to be one.

On the basis of the above embodiment, as an implementation, thestatistical unit includes:

a statistical subunit, configured to perform data statistics on thetarget historical operation behavior data according to differentdimensions to obtain all data items contained in each of the dimensionsand a frequency of each of the data items;

a determination subunit, configured to acquire historical operationbehavior data of all users, and determine duplicate data items in thehistorical operation behavior data of different users;

an updating subunit, configured to denoise duplicate data items in thetarget historical operation behavior data according to principle that ahigher frequency of the duplicate data items corresponds to a lowerweight, so as to update the frequency of the data items; and

a normalization subunit, configured to normalize the updated frequencyto obtain the standard frequency of each of the data items.

On the basis of the above embodiment, as an implementation, a frequencyupdating formula of the data item is:

${f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}},$

where f₀ is the updated frequency of the data item, f is the originalfrequency of the data item, F is the sum of the frequencies of the dataitems in historical operation behavior data corresponding to all users,N is the total number of users, n is the total number of users who havethe data item, and k is an experience coefficient.

On the basis of the above embodiment, as an implementation, themonitoring module 605 includes:

a second calculation unit, configured to calculate a center of gravitycorresponding to each of the coordinate axes according to the density ofall the marking points on each of the coordinate axes, and determine atarget point based on all the centers of gravity; and

a determining unit, configured to determine whether the target point iswithin a preset safe area, and determine that the target operationbehavior is a safe operation behavior under the condition that thetarget point is within a preset safe area.

On the basis of the above embodiment, as an implementation, themonitoring module 605 includes:

a second calculation unit, configured to calculate a center of gravitycorresponding to each of the coordinate axes according to the density ofall the marking points on each of the coordinate axes, and determine atarget point based on all the centers of gravity; and

a third calculation unit, configured to calculate a safe confidencelevel of the target operation behavior based on a distance between thetarget point and an original point in the multi-dimensional coordinatesystem, wherein the safe confidence level is negatively correlated withthe distance between the target point and the original point in themulti-dimensional coordinate system.

On the basis of the above embodiment, as an implementation, thedimension includes a work directory, an operation instruction and alogin identification.

The specific manner in which the various modules of the apparatus in theabove embodiment perform operations has been described in detail in theembodiment of the method, and will not be described in detail herein.

The present disclosure also provides an electronic device. FIG. 7 showsa structural diagram of an electronic device 700 according to anexemplary embodiment. As shown in FIG. 7 , the electronic device mayinclude a processor 11 and a memory 12. The electronic device 700 mayalso include one or more of a multimedia assembly 13, an Input/Output(I/O) interface 14, and a communication assembly 15.

The processor 11 is configured to control an overall operation of theelectronic device 700 so as to complete all or part of the operations inthe above operation behavior monitoring method. The memory 12 isconfigured to store various types of data to support the operation atthe electronic device 700. The data may include, for example,instructions for any application or method operating on the electronicdevice 700, as well as application-related data, such as contact data,transmitted and received messages, pictures, audio, and video. Thememory 12 may be implemented by any type of volatile or non-volatilestorage apparatus or combination thereof, such as a Static Random AccessMemory (SRAM), an Electrically Erasable Programmable Read-Only Memory(EEPROM), an Erasable Programmable Read-Only Memory (EPROM), aProgrammable Read-Only Memory (PROM), a Read-Only Memory (ROM), amagnetic memory, a flash memory, and a magnetic or optical disk. Themultimedia assembly 13 may include a screen and an audio assembly. Thescreen may be, for example, a touch screen, and the audio assembly isconfigured to output and/or input audio signals. For example, the audioassembly may include a microphone for receiving external audio signals.The received audio signals may be further stored in the memory 12 ortransmitted via the communication assembly 15. The audio assembly alsoincludes at least one speaker for outputting the audio signals. The I/Ointerface 14 is an interface provided between the processor 11 and otherinterface modules such as a keyboard, a mouse or buttons. These buttonsmay be virtual buttons or physical buttons. The communication assembly15 is configured to perform wired or wireless communication between theelectronic device 700 and other apparatuses. The wireless communication,such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G,or one or a combination thereof. Therefore, the communication assembly15 may include a Wi-Fi module, a Bluetooth module and an NFC moduleaccordingly.

In an exemplary embodiment, the electronic device 700 may be implementedby one or more Application Specific Integrated Circuits (ASIC), DigitalSignal Processors (DSP), Digital Signal Processing Devices (DSPD),Programmable Logic Devices (PLD), Field Programmable Gate Arrays (FPGA),controllers, micro control units, micro processing units, or otherelectronic components to perform the above operation behavior monitoringmethod.

In another exemplary embodiment, there is also provided acomputer-readable storage medium 400 including a program instruction402. As shown in FIG. 8 , the program instruction 402, when executed bya processor 401, implements the operations of the above operationbehavior monitoring method. For example, the computer-readable storagemedium 400 may be the memory 12 including the above program instructionthat is executable by the processor 11 of the electronic device 700 tocomplete the above operation behavior monitoring method.

In the specification, each embodiment is described in a progressivemanner. Each embodiment focuses on the differences with otherembodiments. The same and similar parts of each embodiment may bereferred to each other. For the device disclosed in the embodiment,since it corresponds to the method disclosed in the embodiment, thedescription is relatively simple. Please refer to the description of themethod section for details. It should be pointed out that for ordinarytechnicians in the technical field, without departing from theprinciples of the present disclosure, a number of improvements andmodifications may be made to the present disclosure, which also fallwithin the protection scope of the claims of the present disclosure.

It should also be noted that in this specification, relational termssuch as first and second are only used to distinguish one entity oroperation from another entity or operation, and do not necessarilyrequire or imply any such actual relationship or order between theseentities or operations. Moreover, the terms “including”, “comprising” orany other variant thereof are intended to cover non-exclusive inclusion,so that a process, method, article or equipment including a series ofelements not only includes those elements, but also includes otherelements not explicitly listed, or also includes elements inherent tosuch process, method, article or equipment. Without furtherrestrictions, the elements defined by the statement “including one . . .” do not exclude that there are other identical elements in the process,method, article or equipment including the elements.

1. An operation behavior monitoring method, comprising: acquiring targethistorical operation behavior data of a target user, and performing datastatistics on the target historical operation behavior data according todifferent dimensions so as to establish a multi-dimensional coordinatesystem, wherein coordinate axes in the multi-dimensional coordinatesystem are in one-to-one correspondence with the dimensions;determining, in response to receiving a target operation behavior, atarget data item corresponding to the target operation behavior in eachof the dimensions, and determining whether a marking point correspondingto the target data item exists in the multi-dimensional coordinatesystem; increasing a density of the marking point by one under thecondition that the marking point corresponding to the target data itemexists in the multi-dimensional coordinate system; under the conditionthat the marking point corresponding to the target data item does notexist in the multi-dimensional coordinate system, determining themarking point corresponding to the target data item in themulti-dimensional coordinate system, and setting the density of themarking point to be one, wherein a coordinate value of the marking pointcorresponding to the target data item is less than 1 under the conditionthat the target data item exists in the target historical operationbehavior data, and the coordinate value of the marking pointcorresponding to the target data item is greater than 1 under thecondition that the target data item does not exist in the targethistorical operation behavior data; and calculating a center of gravitycorresponding to each of the coordinate axes according to the density ofall the marking points on each of the coordinate axes, and determining atarget point based on all the centers of gravity so as to perform safetymonitoring on the target operation behavior according to the position ofthe target point.
 2. The operation behavior monitoring method accordingto claim 1, wherein the performing data statistics on the targethistorical operation behavior data according to different dimensions soas to establish a multi-dimensional coordinate system comprises:performing the data statistics on the target historical operationbehavior data according to different dimensions to obtain all data itemscontained in each of the dimensions and a frequency of each of the dataitems, and normalizing the frequency to obtain a standard frequency ofeach of the data items; and establishing a multi-dimensional coordinatesystem, and marking each of the data items on a coordinate axiscorresponding to the dimension to which each of the data items belongsbased on the standard frequency of each of the data items, wherein thecoordinate axes in the multi-dimensional coordinate system are inone-to-one correspondence with the dimensions, A=1−f_(A), A is thecoordinate value of a marking position of the data item, and f_(A) isthe standard frequency of the data item.
 3. The operation behaviormonitoring method according to claim 2, wherein after the marking eachof the data items on a coordinate axis corresponding to the dimension towhich each of the data items belongs based on the standard frequency ofeach of the data items, the method further comprises: determining atotal number of data items corresponding to each of the coordinate axes,and calculating a unit distance p of each of the coordinate axes,wherein p=1/S, and S is the total number of the data items; thedetermining a marking point corresponding to the target data item in themulti-dimensional coordinate system comprises: determining B=1−f_(B)under the condition that the target data item exists in the targethistorical operation behavior data, wherein B is the coordinate value ofthe marking point of the target data item, and f_(B) is the standardfrequency of the target data item in the target historical operationbehavior data; and determining B=1+bp under the condition that thetarget data item does not exist in the target historical operationbehavior data, wherein b is a positive integer and b is negativelycorrelated with the frequency of the target data item in the targetoperation behavior.
 4. The operation behavior monitoring methodaccording to claim 2, wherein before the normalizing the frequency toobtain a standard frequency of each of the data items, the methodfurther comprises: acquiring historical operation behavior data of allusers, and determining duplicate data items in the historical operationbehavior data of different users; denoising the duplicate data items inthe target historical operation behavior data according to principlethat a higher frequency of the duplicate data items corresponds to alower weight, so as to update the frequency of the data items; thenormalizing the frequency to obtain a standard frequency of each of thedata items comprises: normalizing an updated frequency to obtain thestandard frequency of each of the data items.
 5. The operation behaviormonitoring method according to claim 4, wherein a frequency updatingformula of the data item is:${f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}},$ wherein f₀ isthe updated frequency of the data item, f is an original frequency ofthe data item, F is a sum of the frequencies of the data items inhistorical operation behavior data corresponding to all users, N is thetotal number of the users, n is the total number of users who have thedata item, and k is an experience coefficient.
 6. The operation behaviormonitoring method according to claim 1, wherein the performing safetymonitoring on the target operation behavior according to the position ofthe target point comprises: determining whether the target point iswithin a preset safe area, and determining that the target operationbehavior is a safe operation behavior under the condition that thetarget point is within a preset safe area; or, calculating a safeconfidence level of the target operation behavior based on a distancebetween the target point and an original point in the multi-dimensionalcoordinate system, wherein the safe confidence level is negativelycorrelated with the distance between the target point and the originalpoint in the multi-dimensional coordinate system.
 7. The operationbehavior monitoring method according to claim 1, wherein the dimensioncomprises a work directory, an operation instruction and a loginidentification.
 8. (canceled)
 9. An electronic device, comprising: amemory, configured to store a computer program; and a processor, whenexecuting the computer program, configured for: acquiring targethistorical operation behavior data of a target user, and performing datastatistics on the target historical operation behavior data according todifferent dimensions so as to establish a multi-dimensional coordinatesystem, wherein coordinate axes in the multi-dimensional coordinatesystem are in one-to-one correspondence with the dimensions;determining, in response to receiving a target operation behavior, atarget data item corresponding to the target operation behavior in eachof the dimensions, and determining whether a marking point correspondingto the target data item exists in the multi-dimensional coordinatesystem; increasing a density of the marking point by one under thecondition that the marking point corresponding to the target data itemexists in the multi-dimensional coordinate system; under the conditionthat the marking point corresponding to the target data item does notexist in the multi-dimensional coordinate system, determining themarking point corresponding to the target data item in themulti-dimensional coordinate system, and setting the density of themarking point to be one, wherein a coordinate value of the marking pointcorresponding to the target data item is less than 1 under the conditionthat the target data item exists in the target historical operationbehavior data, and the coordinate value of the marking pointcorresponding to the target data item is greater than 1 under thecondition that the target data item does not exist in the targethistorical operation behavior data; and calculating a center of gravitycorresponding to each of the coordinate axes according to the density ofall the marking points on each of the coordinate axes, and determining atarget point based on all the centers of gravity so as to perform safetymonitoring on the target operation behavior according to the position ofthe target point.
 10. A computer-readable storage medium, storing acomputer program which, when executed by a processor, implements theoperations comprising: acquiring target historical operation behaviordata of a target user, and performing data statistics on the targethistorical operation behavior data according to different dimensions soas to establish a multi-dimensional coordinate system, whereincoordinate axes in the multi-dimensional coordinate system are inone-to-one correspondence with the dimensions; determining, in responseto receiving a target operation behavior, a target data itemcorresponding to the target operation behavior in each of thedimensions, and determining whether a marking point corresponding to thetarget data item exists in the multi-dimensional coordinate system;increasing a density of the marking point by one under the conditionthat the marking point corresponding to the target data item exists inthe multi-dimensional coordinate system; under the condition that themarking point corresponding to the target data item does not exist inthe multi-dimensional coordinate system, determining the marking pointcorresponding to the target data item in the multi-dimensionalcoordinate system, and setting the density of the marking point to beone, wherein a coordinate value of the marking point corresponding tothe target data item is less than 1 under the condition that the targetdata item exists in the target historical operation behavior data, andthe coordinate value of the marking point corresponding to the targetdata item is greater than 1 under the condition that the target dataitem does not exist in the target historical operation behavior data;and calculating a center of gravity corresponding to each of thecoordinate axes according to the density of all the marking points oneach of the coordinate axes, and determining a target point based on allthe centers of gravity so as to perform safety monitoring on the targetoperation behavior according to the position of the target point. 11.The electronic device according to claim 9, wherein the performing datastatistics on the target historical operation behavior data according todifferent dimensions so as to establish a multi-dimensional coordinatesystem comprises: performing the data statistics on the targethistorical operation behavior data according to different dimensions toobtain all data items contained in each of the dimensions and afrequency of each of the data items, and normalizing the frequency toobtain a standard frequency of each of the data items; and establishinga multi-dimensional coordinate system, and marking each of the dataitems on a coordinate axis corresponding to the dimension to which eachof the data items belongs based on the standard frequency of each of thedata items, wherein the coordinate axes in the multi-dimensionalcoordinate system are in one-to-one correspondence with the dimensions,A=1−f_(A), A is the coordinate value of a marking position of the dataitem, and f_(A) is the standard frequency of the data item.
 12. Theelectronic device according to claim 11, wherein after the marking eachof the data items on a coordinate axis corresponding to the dimension towhich each of the data items belongs based on the standard frequency ofeach of the data items, the processor is further configured for:determining a total number of data items corresponding to each of thecoordinate axes, and calculating a unit distance p of each of thecoordinate axes, wherein p=1/S, and S is the total number of the dataitems; the determining a marking point corresponding to the target dataitem in the multi-dimensional coordinate system comprises: determiningB=1−f_(B) under the condition that the target data item exists in thetarget historical operation behavior data, wherein B is the coordinatevalue of the marking point of the target data item, and f_(B) is thestandard frequency of the target data item in the target historicaloperation behavior data; and determining B=1+bp under the condition thatthe target data item does not exist in the target historical operationbehavior data, wherein b is a positive integer and b is negativelycorrelated with the frequency of the target data item in the targetoperation behavior.
 13. The electronic device according to claim 11,wherein before the normalizing the frequency to obtain a standardfrequency of each of the data items, the processor is further configuredfor: acquiring historical operation behavior data of all users, anddetermining duplicate data items in the historical operation behaviordata of different users; denoising the duplicate data items in thetarget historical operation behavior data according to principle that ahigher frequency of the duplicate data items corresponds to a lowerweight, so as to update the frequency of the data items; the normalizingthe frequency to obtain a standard frequency of each of the data itemscomprises: normalizing an updated frequency to obtain the standardfrequency of each of the data items.
 14. The electronic device accordingto claim 13, wherein a frequency updating formula of the data item is:${f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}},$ wherein f₀ isthe updated frequency of the data item, f is an original frequency ofthe data item, F is a sum of the frequencies of the data items inhistorical operation behavior data corresponding to all users, N is thetotal number of the users, n is the total number of users who have thedata item, and k is an experience coefficient.
 15. The electronic deviceaccording to claim 9, wherein the performing safety monitoring on thetarget operation behavior according to the position of the target pointcomprises: determining whether the target point is within a preset safearea, and determining that the target operation behavior is a safeoperation behavior under the condition that the target point is within apreset safe area; or, calculating a safe confidence level of the targetoperation behavior based on a distance between the target point and anoriginal point in the multi-dimensional coordinate system, wherein thesafe confidence level is negatively correlated with the distance betweenthe target point and the original point in the multi-dimensionalcoordinate system.
 16. The electronic device according to claim 9,wherein the dimension comprises a work directory, an operationinstruction and a login identification.
 17. The computer-readablestorage medium according to claim 10, wherein the performing datastatistics on the target historical operation behavior data according todifferent dimensions so as to establish a multi-dimensional coordinatesystem comprises: performing the data statistics on the targethistorical operation behavior data according to different dimensions toobtain all data items contained in each of the dimensions and afrequency of each of the data items, and normalizing the frequency toobtain a standard frequency of each of the data items; and establishinga multi-dimensional coordinate system, and marking each of the dataitems on a coordinate axis corresponding to the dimension to which eachof the data items belongs based on the standard frequency of each of thedata items, wherein the coordinate axes in the multi-dimensionalcoordinate system are in one-to-one correspondence with the dimensions,A=1−f_(A), A is the coordinate value of a marking position of the dataitem, and f_(A) is the standard frequency of the data item.
 18. Thecomputer-readable storage medium according to claim 17, wherein afterthe marking each of the data items on a coordinate axis corresponding tothe dimension to which each of the data items belongs based on thestandard frequency of each of the data items, the operations furthercomprise: determining a total number of data items corresponding to eachof the coordinate axes, and calculating a unit distance p of each of thecoordinate axes, wherein p=1/S, and S is the total number of the dataitems; the determining a marking point corresponding to the target dataitem in the multi-dimensional coordinate system comprises: determiningB=1−f_(B) under the condition that the target data item exists in thetarget historical operation behavior data, wherein B is the coordinatevalue of the marking point of the target data item, and f_(B) is thestandard frequency of the target data item in the target historicaloperation behavior data; and determining B=1+bp under the condition thatthe target data item does not exist in the target historical operationbehavior data, wherein b is a positive integer and b is negativelycorrelated with the frequency of the target data item in the targetoperation behavior.
 19. The computer-readable storage medium accordingto claim 17, wherein before the normalizing the frequency to obtain astandard frequency of each of the data items, the operations furthercomprise: acquiring historical operation behavior data of all users, anddetermining duplicate data items in the historical operation behaviordata of different users; denoising the duplicate data items in thetarget historical operation behavior data according to principle that ahigher frequency of the duplicate data items corresponds to a lowerweight, so as to update the frequency of the data items; the normalizingthe frequency to obtain a standard frequency of each of the data itemscomprises: normalizing an updated frequency to obtain the standardfrequency of each of the data items.
 20. The computer-readable storagemedium according to claim 19, wherein a frequency updating formula ofthe data item is:${f_{0} = {k \times \frac{f^{2}}{F} \times \frac{N}{n}}},$ wherein f₀ isthe updated frequency of the data item, f is an original frequency ofthe data item, F is a sum of the frequencies of the data items inhistorical operation behavior data corresponding to all users, N is thetotal number of the users, n is the total number of users who have thedata item, and k is an experience coefficient.
 21. The computer-readablestorage medium according to claim 10, wherein the performing safetymonitoring on the target operation behavior according to the position ofthe target point comprises: determining whether the target point iswithin a preset safe area, and determining that the target operationbehavior is a safe operation behavior under the condition that thetarget point is within a preset safe area; or, calculating a safeconfidence level of the target operation behavior based on a distancebetween the target point and an original point in the multi-dimensionalcoordinate system, wherein the safe confidence level is negativelycorrelated with the distance between the target point and the originalpoint in the multi-dimensional coordinate system.